Security audit

动态提示生成服务

Security checks for vulnerabilities and agentic risk

Overview

This remote prompt/template skill is mostly purpose-aligned, but it stores an API key in a local plaintext .env file and can send that key and user context to a configurable endpoint.

Review before installing. Use this only if you are comfortable sending prompt inputs, project context, and bug details to the XiaoBenYang MCP API. Do not provide secrets or private source code as context. Prefer setting the API key through a secure environment/secret mechanism, verify .env is not committed or shared, and avoid using untrusted .env files that could change the API endpoint.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/tools.py:15
Finding: Potentially Sensitive User Context Is Transmitted to an External Service Without Explicit Disclosure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/config.py:42
Finding: API Key Is Persisted in a Plaintext Working-Directory File Without Restrictive Permissions
Content: View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The API credential is written in plaintext to `.env`, resolved relative to the process's current working directory. The code does not use a dedicated per-user configuration directory, enforce owner-only permissions such as `0600`, perform an atomic write, reject symbolic links, or use an operating-system credential store. Because the location depends on the current working directory, the credential can be placed inside an unrelated source repository or shared directory. Existing file permissions are not inspected or corrected. A pre-created symbolic link could also cause the credential to be written to another file accessible to an attacker, subject to the process's permissions. ### Attack Path 1. The Skill asks the user to provide an API key. 2. The Skill calls `set_api_key()`, which invokes `save_api_key_to_env()`. 3. The function resolves `.env` in the current working directory. 4. The key ...[truncated 680 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/config.py:11
Finding: Environment-Controlled Base URL Can Redirect Credentials and User Content to an Attacker-Controlled Host
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Dependencies Are Specified With Open-Ended Minimum Versions
Content: View full analysis
=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1 ``` ### Technical Analysis All dependencies use minimum-only constraints. Future installations may therefore resolve to versions that were not reviewed, including incompatible major releases or a subsequently compromised release. No lock file or package hashes are provided to make installations reproducible. The audited package names are conventional, and the project contains no evidence of dependency confusion, typosquatting, malicious packages, or unsafe package indexes. This finding concerns supply-chain hardening rather than a confirmed malicious dependency. ### Attack Path 1. A user installs the Skill's requirements at a later date. 2. The package resolver selects newly published versions satisfying the open-ended constraints. 3. A selected release contains a malicious modification, compromised distribution artifact, or security-relevant incompatibility. 4. The dependency code executes in the Skill's Python environment when imported or used. 5. Any resulting impact occurs with the permissions of the process running the Skill. ### Impact Assessment The possible impact depends on the behavior of a future compromised dependency. Python dependency code generally executes with the same filesystem, network, environment-variable, and process privileges as the Skill. There is no evidence that this exploitation has occurred in the reviewed project, so the current risk is low and precautionary. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill claims to generate prompts/templates, but it also instructs reading/writing a local .env file, modifying environment variables, and persisting an API key, with references inconsistent with the stated product domain. Hidden credential storage and configuration mutation materially expand the trust and security implications beyond the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims to generate prompts/templates, but it also instructs reading/writing a local .env file, modifying environment variables, and persisting an API key, with references inconsistent with the stated product domain. Hidden credential storage and configuration mutation materially expand the trust and security implications beyond the declared purpose.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config.py (reported line 13)May include surrounding context.
python
model_config = SettingsConfigDict( env_prefix="XBY_GAOKAO_", env_file=".env", env_file_encoding="utf-8", extra="ignore", )

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The code manually reads .env and extracts XBY_APIKEY outside the settings framework, creating a direct secret-access path that bypasses normal validation and central secret-handling controls. In the context of a prompt-generation skill, custom credential scraping is more dangerous because it broadens secret exposure logic beyond what is necessary and increases the chance of mishandling or future extension into broader file harvesting.
Content: Scanner excerpt · scripts/config.py (reported line 31)May include surrounding context.
python
default_year: int = 2025 def model_post_init(self, __context): # 强制从 .env 文件读取 XBY_APIKEY env_path = Path(".env") if env_path.exists(): content = env_path.read_text(encoding="utf-8")

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The explicit existence check and subsequent read of .env is part of custom secret extraction logic. While not malicious on its face, it unnecessarily expands credential access behavior and increases exposure risk if the file contains other sensitive entries or if future edits broaden parsing.
Content: Scanner excerpt · scripts/config.py (reported line 32)May include surrounding context.
python
def model_post_init(self, __context): # 强制从 .env 文件读取 XBY_APIKEY env_path = Path(".env") if env_path.exists(): content = env_path.read_text(encoding="utf-8") for line in content.splitlines():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config.py (reported line 39)May include surrounding context.
python
if line.startswith("XBY_APIKEY="): self.api_key = line.split("=", 1)[1].strip() break # 如果环境变量有值，覆盖 .env 的值 env_val = os.getenv("XBY_APIKEY", "") if env_val: self.api_key = env_val

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: This function is specifically designed to persist an API key into a local .env file, creating a plaintext credential store on disk. If the machine, workspace, repository, logs, backups, or container image are accessed by another party, the credential can be recovered and abused, making this the strongest secret-handling issue in the file.
Content: Scanner excerpt · scripts/config.py (reported line 48)May include surrounding context.
python
def save_api_key_to_env(api_key: str) -> bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines()

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares no explicit tool scope or permission boundaries while its documented/project capabilities include environment access, file reads/writes, and network calls. In an agent setting, missing least-privilege constraints increases the blast radius if the skill is misused, prompt-injected, or invoked unexpectedly.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest presents a dynamic prompt/template generator, but the actual documented flow includes collecting an external API key, storing it, and returning raw third-party API data. This discrepancy can cause users to expose credentials or approve data-sharing behavior they did not reasonably expect from the stated skill purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs the model to ask the user for an API key and store it, but provides no warning about persistence, exposure risk, revocation, or safer alternatives. Collecting secrets in plain-language conversational flow without clear consent and handling guarantees materially increases the risk of credential leakage or misuse.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation creates an explicit workflow where the model solicits a sensitive API key from the user and persists it locally. In the context of an agent skill, this is dangerous because secrets can be captured in conversation logs, written to insecure storage, or reused outside the user's immediate intent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation states that code only calls APIs, but the workflow also requires saving a user-provided API key locally via configuration. This is a security-relevant omission because credential persistence changes the threat model from transient use to retention and possible later exposure.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill tells the model to directly display result['raw'] from the API response after simple formatting. Raw upstream responses may include sensitive content, debugging metadata, tokens, identifiers, or unexpected fields, so unreviewed passthrough creates a data exposure risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Manifest 将该技能描述为动态提示生成与模板组装服务，但此文件实现了将 API key 写入 .env 文件、更新进程环境变量并维护全局凭据状态的能力。这不是该描述下显而易见的提示生成实现细节，而是本地凭据持久化与配置修改行为。
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: save_api_key_to_env 会读取并重写 .env 文件，同时写入 os.environ，这为技能增加了本地敏感配置持久化能力。对于一个以提示生成和模板组装为目的的技能而言，此类凭据存储/修改能力并非其核心功能所直接需要。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The function writes the API key in plaintext to a local .env file and also exports it into the current process environment without any confirmation, warning, or permission checks. In shared workspaces, developer machines, containers, or repos where .env files may be copied, backed up, or accidentally committed, this can expose credentials and enable unauthorized API use.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The skill's mandatory operational instructions and safety-critical setup steps are presented in Chinese, while the tool descriptions are partly in English, and there is no indication that users may choose their preferred language. This can amount to a language/locale policy issue because the skill effectively imposes a language for critical interaction without opt-in.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency is specified with a lower bound only (requests>=2.31.0), which makes builds non-reproducible and allows future installs to pull in unexpected versions. In a security-sensitive prompt-generation service, this increases supply-chain risk and makes it harder to verify whether a deployed version includes known fixes or newly introduced vulnerabilities.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: requests has known security advisories, but because the manifest does not pin an exact version, it is impossible to verify whether deployments are using a fixed or affected release. This creates supply-chain uncertainty: some environments may resolve to safe versions while others may pull vulnerable ones, undermining security assurance.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: pydantic>=2.7.0 is unpinned, so installations may resolve to different versions over time. This weakens reproducibility and can silently introduce vulnerable or incompatible releases into the service, especially important for software that processes dynamic prompts and configuration data.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 86% confidence
Finding: pydantic has published advisories, and the lack of version pinning means the actual installed version cannot be audited from this file alone. Since this library is central to data validation and settings parsing, uncertainty about its version weakens confidence in input-handling safety and patch status.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: pydantic-settings>=2.2.0 allows any newer version to be installed, preventing certainty about the exact code running in production. For configuration-loading libraries, this is risky because security behavior around environment variables, secret handling, and filesystem access can change across releases.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1

Unverifiable Dependency: pydantic-settings has 1 known advisory(ies) (CVE-2026-58203 (pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 84% confidence
Finding: pydantic-settings has at least one known advisory, but the unpinned requirement prevents determining whether the installed package is affected. Because this package may interact with secrets and local filesystem-based configuration sources, version ambiguity is a meaningful security hygiene issue in a service context.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: python-dotenv>=1.0.1 is not pinned, so the environment-loading component may vary between installations. Because dotenv tooling influences how configuration and secrets are read from files, unbounded upgrades can expose the service to regressions or vulnerable behaviors without explicit review.
Content: Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.
text
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 84% confidence
Finding: python-dotenv has known advisories and is not pinned, so the security posture of deployed instances cannot be confirmed from this manifest. In services that may load environment files during startup or local development, uncertainty around file-handling behavior can translate into avoidable configuration or filesystem risk.
Content: No source excerpt is available for this finding.